Vulnerability · Published Oct 10, 2025 · Assigned by INCIBE
CVE-2025-41088Stored Cross-Site Scripting (XSS) in CMS
Medium 5.1
In plain English
A medium-severity cross-site scripting in Xibo CMS from Xibo Signage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xibo Signage | Xibo CMS | 0 – before 4.2.2 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N